---
id: CVE-2024-53057
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT

  In qdisc_tree_reduce_backlog, Qdiscs with major handle ffff: are assumed
  to be either root or ingress
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT

  In qdisc_tree_reduce_backlog, Qdiscs with major handle ffff: are assumed
  to be either root or ingress. This assu…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-416
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 2.6.25, < 4.19.323'
  - 'linux_kernel >= 4.20, < 5.4.285'
  - 'linux_kernel >= 5.5, < 5.10.229'
  - 'linux_kernel >= 5.11, < 5.15.171'
  - 'linux_kernel >= 5.16, < 6.1.116'
  - 'linux_kernel >= 6.2, < 6.6.60'
  - 'linux_kernel >= 6.7, < 6.11.7'
  - linux_kernel = 6.12
patched:
  - linux_kernel 6.11.7
published: '2024-11-19'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:19:13.497'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-53057'
references:
  - url: 'https://git.kernel.org/stable/c/05df1b1dff8f197f1c275b57ccb2ca33021df552'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2e95c4384438adeaa772caa560244b1a2efef816'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/580b3189c1972aff0f993837567d36392e9d981b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/597cf9748c3477bf61bc35f0634129f56764ad24'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9995909615c3431a5304c1210face5f268d24dba'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ce691c814bc7a3c30c220ffb5b7422715458fd9b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/dbe778b08b5101df9e89bc06e0a3a7ecd2f4ef20'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e7f9a6f97eb067599a74f3bcb6761976b0ed303e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-265688.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-355557.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00293
epssPercentile: 0.22033
ingestedAt: '2026-10-15T03:30:12.769Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2024-12-11T14:25:23.594430Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT

In qdisc_tree_reduce_backlog, Qdiscs with major handle ffff: are assumed
to be either root or ingress. This assumption is bogus since it's valid
to create egress qdiscs with major handle ffff:
Budimir Markovic found that for qdiscs like DRR that maintain an active
class list, it will cause a UAF with a dangling class pointer.

In 066a3b5b2346, the concern was to avoid iterating over the ingress
qdisc since its parent is itself. The proper fix is to stop when parent
TC_H_ROOT is reached because the only way to retrieve ingress is when a
hierarchy which does not contain a ffff: major handle call into
qdisc_lookup with TC_H_MAJ(TC_H_ROOT).

In the scenario where major ffff: is an egress qdisc in any of the tree
levels, the updates will also propagate to TC_H_ROOT, which then the
iteration must stop.


 net/sched/sch_api.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

## Affected

- `linux_kernel >= 2.6.25, < 4.19.323`
- `linux_kernel >= 4.20, < 5.4.285`
- `linux_kernel >= 5.5, < 5.10.229`
- `linux_kernel >= 5.11, < 5.15.171`
- `linux_kernel >= 5.16, < 6.1.116`
- `linux_kernel >= 6.2, < 6.6.60`
- `linux_kernel >= 6.7, < 6.11.7`
- `linux_kernel = 6.12`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.11.7`